Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
17/07/2023, 13:27
Static task
static1
Behavioral task
behavioral1
Sample
88550b713dda18_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
88550b713dda18_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
88550b713dda18_JC.exe
-
Size
280KB
-
MD5
88550b713dda181f1cc2c3179a069987
-
SHA1
b674758b118cc935343d45a1df3be2b371c54879
-
SHA256
de22f3a6f9e223c9f31fd13031f6adaf35cbb7908e34f30fdb6dd67a545169ff
-
SHA512
cba7382cff07cb23ea6d3246f8a81a435f2730bb97d3dd7bb4f13fb562ccc26189be133497ee6fe82dc44ebae653c58a2cfaf999e5d9e369e5676b6856133e9a
-
SSDEEP
6144:QTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDK:QTBPFV0RyWl3h2E+7pl
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1004 SearchIndexerDB.exe 2792 SearchIndexerDB.exe -
Loads dropped DLL 3 IoCs
pid Process 1996 88550b713dda18_JC.exe 1996 88550b713dda18_JC.exe 1996 88550b713dda18_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 28 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\Content-Type = "application/x-msdownload" 88550b713dda18_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe 88550b713dda18_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\open 88550b713dda18_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\DefaultIcon 88550b713dda18_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\shell\runas\command 88550b713dda18_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*" 88550b713dda18_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos 88550b713dda18_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\shell\runas\command\ = "\"%1\" %*" 88550b713dda18_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\shell\open\command 88550b713dda18_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\SearchIndexerDB.exe\" /START \"%1\" %*" 88550b713dda18_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\DefaultIcon\ = "%1" 88550b713dda18_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell 88550b713dda18_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\runas\command 88550b713dda18_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\shell\open 88550b713dda18_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\ = "Application" 88550b713dda18_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\DefaultIcon\ = "%1" 88550b713dda18_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\shell 88550b713dda18_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\ = "cmos" 88550b713dda18_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" 88550b713dda18_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\runas 88550b713dda18_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" 88550b713dda18_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\DefaultIcon 88550b713dda18_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\shell\open\command\IsolatedCommand = "\"%1\" %*" 88550b713dda18_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\shell\runas 88550b713dda18_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\cmos\shell\runas\command\IsolatedCommand = "\"%1\" %*" 88550b713dda18_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\Content-Type = "application/x-msdownload" 88550b713dda18_JC.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\open\command 88550b713dda18_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\SearchIndexerDB.exe\" /START \"%1\" %*" 88550b713dda18_JC.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1004 SearchIndexerDB.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1996 wrote to memory of 1004 1996 88550b713dda18_JC.exe 28 PID 1996 wrote to memory of 1004 1996 88550b713dda18_JC.exe 28 PID 1996 wrote to memory of 1004 1996 88550b713dda18_JC.exe 28 PID 1996 wrote to memory of 1004 1996 88550b713dda18_JC.exe 28 PID 1004 wrote to memory of 2792 1004 SearchIndexerDB.exe 29 PID 1004 wrote to memory of 2792 1004 SearchIndexerDB.exe 29 PID 1004 wrote to memory of 2792 1004 SearchIndexerDB.exe 29 PID 1004 wrote to memory of 2792 1004 SearchIndexerDB.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\88550b713dda18_JC.exe"C:\Users\Admin\AppData\Local\Temp\88550b713dda18_JC.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Roaming\Microsoft\Posix\SearchIndexerDB.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Posix\SearchIndexerDB.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\SearchIndexerDB.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Roaming\Microsoft\Posix\SearchIndexerDB.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Posix\SearchIndexerDB.exe"3⤵
- Executes dropped EXE
PID:2792
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280KB
MD5a13dfa047b41f61c9df82b242262035e
SHA157e14be2b973d3e3d73cd18d3aba16a591113016
SHA256119bd8f957f0c75981ec190134104a3de90bf5431480fe384b11e796f80e15b8
SHA5129adfc08fa44e4c6bbea3598cd9fc83f89b19dbfb557b51cc7034338d8c7b50da1906ed41d6d88c9a3b73fa9483759e48dd94816d52e9f53e3951d093935d8ca0
-
Filesize
280KB
MD5a13dfa047b41f61c9df82b242262035e
SHA157e14be2b973d3e3d73cd18d3aba16a591113016
SHA256119bd8f957f0c75981ec190134104a3de90bf5431480fe384b11e796f80e15b8
SHA5129adfc08fa44e4c6bbea3598cd9fc83f89b19dbfb557b51cc7034338d8c7b50da1906ed41d6d88c9a3b73fa9483759e48dd94816d52e9f53e3951d093935d8ca0
-
Filesize
280KB
MD5a13dfa047b41f61c9df82b242262035e
SHA157e14be2b973d3e3d73cd18d3aba16a591113016
SHA256119bd8f957f0c75981ec190134104a3de90bf5431480fe384b11e796f80e15b8
SHA5129adfc08fa44e4c6bbea3598cd9fc83f89b19dbfb557b51cc7034338d8c7b50da1906ed41d6d88c9a3b73fa9483759e48dd94816d52e9f53e3951d093935d8ca0
-
Filesize
280KB
MD5a13dfa047b41f61c9df82b242262035e
SHA157e14be2b973d3e3d73cd18d3aba16a591113016
SHA256119bd8f957f0c75981ec190134104a3de90bf5431480fe384b11e796f80e15b8
SHA5129adfc08fa44e4c6bbea3598cd9fc83f89b19dbfb557b51cc7034338d8c7b50da1906ed41d6d88c9a3b73fa9483759e48dd94816d52e9f53e3951d093935d8ca0
-
Filesize
280KB
MD5a13dfa047b41f61c9df82b242262035e
SHA157e14be2b973d3e3d73cd18d3aba16a591113016
SHA256119bd8f957f0c75981ec190134104a3de90bf5431480fe384b11e796f80e15b8
SHA5129adfc08fa44e4c6bbea3598cd9fc83f89b19dbfb557b51cc7034338d8c7b50da1906ed41d6d88c9a3b73fa9483759e48dd94816d52e9f53e3951d093935d8ca0
-
Filesize
280KB
MD5a13dfa047b41f61c9df82b242262035e
SHA157e14be2b973d3e3d73cd18d3aba16a591113016
SHA256119bd8f957f0c75981ec190134104a3de90bf5431480fe384b11e796f80e15b8
SHA5129adfc08fa44e4c6bbea3598cd9fc83f89b19dbfb557b51cc7034338d8c7b50da1906ed41d6d88c9a3b73fa9483759e48dd94816d52e9f53e3951d093935d8ca0
-
Filesize
280KB
MD5a13dfa047b41f61c9df82b242262035e
SHA157e14be2b973d3e3d73cd18d3aba16a591113016
SHA256119bd8f957f0c75981ec190134104a3de90bf5431480fe384b11e796f80e15b8
SHA5129adfc08fa44e4c6bbea3598cd9fc83f89b19dbfb557b51cc7034338d8c7b50da1906ed41d6d88c9a3b73fa9483759e48dd94816d52e9f53e3951d093935d8ca0